Data Processing Agreement

1. Introduction

This Data Processing Agreement ("DPA") forms part of the Terms of Service between you ("Customer", "Data Controller") and Revia ("Processor", "we", "us") and applies to the processing of Personal Data in connection with the AI-powered WhatsApp assistant service ("Service").

This DPA reflects the parties' agreement regarding the processing of Personal Data in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR) and other applicable privacy laws.

2. Definitions

3. Scope and Purpose of Processing

3.1 Nature and Purpose

Revia processes Personal Data solely to provide the Service, which includes:

• Processing WhatsApp messages to provide AI assistance
• Analyzing message content for context, tone, and intent
• Generating response drafts and summaries
• Managing user accounts and authentication
• Providing customer support

3.2 Categories of Personal Data

The Personal Data processed may include:

• Contact information (phone numbers, names)
• Communication content (WhatsApp messages)
• Account information (user preferences, settings)
• Technical data (device IDs, IP addresses, usage logs)

3.3 Categories of Data Subjects

Data Subjects may include:

• Customers (users of the Service)
• Contacts of Customers (WhatsApp communication participants)
• Representatives and employees of Customer organizations

4. Customer Obligations

The Customer agrees and warrants that:

• It has all necessary rights and consents to provide Personal Data to Revia for processing
• It complies with all applicable data protection laws
• Processing instructions provided to Revia comply with applicable laws
• It has implemented appropriate security measures for Personal Data
• It will promptly inform Revia of any errors or inaccuracies in Personal Data

5. Processor Obligations

Revia agrees to:

5.1 Processing Instructions

Process Personal Data only on documented instructions from the Customer, unless required to do so by applicable law. We will inform the Customer if, in our opinion, an instruction infringes applicable data protection law.

5.2 Confidentiality

Ensure that persons authorized to process Personal Data are bound by confidentiality obligations or under an appropriate statutory obligation of confidentiality.

5.3 Security Measures

Implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of Personal Data in transit and at rest
• Regular security assessments and penetration testing
• Access controls and authentication mechanisms
• Secure development practices and code reviews
• Incident response and disaster recovery procedures
• Employee training on data protection and security

5.4 Sub-processors

Not engage sub-processors without prior written authorization from the Customer. Currently authorized sub-processors include cloud infrastructure providers and AI service providers. We will inform the Customer of any intended changes concerning the addition or replacement of sub-processors.

5.5 Data Subject Rights

Assist the Customer in responding to Data Subject requests to exercise their rights under applicable data protection law, including rights to access, rectification, erasure, data portability, and objection.

6. Data Security

Revia implements industry-standard security measures to protect Personal Data:

7. Data Breach Notification

In the event of a Personal Data breach, Revia will:

• Notify the Customer without undue delay (within 72 hours when feasible)
• Provide details of the breach, including affected data categories and approximate number of affected Data Subjects
• Describe likely consequences of the breach
• Describe measures taken or proposed to address the breach
• Provide contact details for further information
• Assist the Customer in fulfilling their breach notification obligations

8. Data Protection Impact Assessments

Revia will provide reasonable assistance to the Customer in conducting Data Protection Impact Assessments (DPIAs) when required under applicable data protection law, considering the nature of processing and information available to us.

9. Data Retention and Deletion

Upon termination of the Service or upon Customer request, Revia will:

• Delete or return all Personal Data to the Customer as instructed
• Delete existing copies unless retention is required by applicable law
• Certify deletion upon Customer request

Messages, contacts, goals, memory and documents are stored for as long as your account exists so Revia can keep context, and are erased when you delete your account (Settings → General → Delete account) or the individual item. Backups are overwritten within 14 days. Account and metadata may otherwise be retained as specified in our Privacy Policy or as required by law.

10. Audits and Inspections

Revia will make available to the Customer information necessary to demonstrate compliance with this DPA and allow for audits, including inspections, conducted by the Customer or an authorized auditor.

Audit requests must be made with reasonable notice and conducted during business hours. Audits must not unreasonably interfere with our business operations.

11. International Data Transfers

When Personal Data is transferred outside the European Economic Area (EEA) or to countries not deemed adequate by the European Commission, Revia will ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the European Commission
• Binding Corporate Rules where applicable
• Other mechanisms permitted under applicable data protection law

12. Limitation of Liability

Each party's liability under this DPA shall be subject to the limitations and exclusions of liability set out in the Terms of Service, except where such limitations or exclusions are not permitted under applicable data protection law.

13. Term and Termination

This DPA will remain in effect for as long as we process Personal Data on behalf of the Customer. Upon termination, the data deletion provisions in Section 9 will apply.

14. Governing Law

This DPA is governed by the same law as the Terms of Service. For EU-based customers, this DPA is subject to GDPR and applicable EU member state data protection laws.

15. Contact Information

For questions about this DPA or data processing practices, please contact: